Existing depositors can re-deposit their funds into frozen strategies

[code423n4]

Lines of code

https://github.com/code-423n4/2023-04-eigenlayer/blob/main/src/contracts/core/StrategyManager.sol#L798

Vulnerability details

Impact

There are two ways to stop users from depositing into a strategy:

1. you pause all deposits
2. you remove a specific strategy from a whitelist

But, those only prevent new funds from being deposited. Existing shares can be redeposited into frozen strategies through the withdrawal system.

Proof of Concept

When withdrawing, you can specify whether you want to receive the underlying tokens or the strategy shares. If the withdrawer selects the strategy shares, the contract doesn't check whether deposits into the strategy are allowed or not.

While you're not able to deposit new funds, you can create a sort of secondary market for existing shares of the given strategy:

1. Alice owns 100 shares in strategy X
2. Strategy X is removed from the whitelist by the protocol owner
3. Bob was planning to deposit into strategy X as well but can't do it anymore.
4. Alice agrees to sell her 100 shares to Bob.
5. Alice queues a withdrawal with Bob as the recipient
6. Bob sends Alice Y a number of tokens worth 100 shares of strategy X

Tools Used

none

Recommended Mitigation Steps

If a strategy is removed from the whitelist or deposits are fully paused, _completeQueuedWithdrawal() should always withdraw the underlying tokens from the strategy.

Assessed type

Invalid Validation

[c4-pre-sort]

0xSorryNotSorry marked the issue as primary issue

[Sidu28]

This is intended. No new deposit has occured.

[c4-sponsor]

Sidu28 marked the issue as sponsor disputed

[c4-judge]

GalloDaSballo marked the issue as duplicate of #199

[c4-judge]

GalloDaSballo changed the severity to QA (Quality Assurance)

[c4-judge]

GalloDaSballo marked the issue as grade-a